Agent Configuration File

While the Agent can be run using command line parameters, it can also be fully configured with a configuration file.

While there is no default location for the configuration, /etc/evebox/agent.yaml is recommended.

The EveBox Agent must also be told where to find the configuration file, for example:

evebox agent -c /etc/evebox/agent.yaml

Command line arguments will always override the configuration file.

The example below includes the optional agent-id, server.key, and pcap settings used to serve full packet captures from the sensor. Set elasticsearch.enabled to false when enabling pcap; the packet capture control channel requires a connection to the EveBox Server and an agent key created there. input.paths may be omitted for a PCAP-only agent.

# EveBox Agent configuration file - subject to change.

# Server information.
server:
  url: http://127.0.0.1:5636

  # Agent key, required for the packet-capture control channel (see the
  # pcap section below). Create one on the server with:
  #     evebox config agents add <name>
  # Also available as the EVEBOX_SERVER_KEY environment variable. Keep
  # this file's permissions restrictive when a key is set.
  #key: eba_...

# Enable output to Elasticsearch. If enabled, the above server section
# will not be used.
elasticsearch:
  enabled: true
  url: http://127.0.0.1:9200
  index: logstash

  # Set to true if the index is a datastream.
  #nodate: false

  #username: username
  #password: password

# Directory to store data and state information required by the agent. This
# isn't always required. If the agent has write access to the log directory it
# can store bookmark information alongside the eve log files.
#data-directory: "/var/lib/evebox"

# If the EveBox server is running behind TLS and the certificate is
# self signed, certificate validation can be disabled.
#disable-certificate-check: true

# Path to Suricata Eve log files.
input:
  paths:
    - "/var/log/suricata/eve.json"
    - "/var/log/suricata/eve.*.json"

# Keep a persistent control connection to the EveBox server and serve packet
# capture requests from this host's Suricata pcap-log spool. Setting a
# directory enables packet capture. The control channel requires an agent
# key (server.key above) unless the server sets
# agents.allow-unauthenticated. This requires EveBox server output;
# it is ignored when direct Elasticsearch output above is enabled.
#
# The --pcap-directory and --pcap-prefix command line options can be used
# instead.
#pcap:
#  directory: /var/log/suricata/pcap
#  # Matches the recommended threaded filename log.%n.%t.pcap.
#  prefix: log.

# Unique identifier this agent advertises on the control channel (also
# available as --agent-id). Defaults to the system hostname; it must be set
# when more than one agent runs on the same host. The identifier is also
# stamped on each imported event (evebox.agent.id) so packet capture
# requests for those events route back to this agent.
#agent-id: firewall-east

# Additional fields that will be added to each event. This is currently limited
# to strings.
additional-fields:
  #sensor-name: "my super secret sensor"

# The event reader can also add the rule to alert events. Do not enable
# if you already have Suricata logging the rule.
#rules:
#  - /var/lib/suricata/rules/*.rules
#  - /usr/share/suricata/rules/*.rules
#  - /etc/suricata/rules/*.rules